Privacy Policy

1. Accountability

a. CityKidz is responsible for personal information under its control. The Executive Director is designated as the Privacy Officer and is accountable to the Board of Directors for ensuring compliance with this policy and applicable privacy legislation.

b. CityKidz ensures that all staff, volunteers, and contractors who handle personal information are aware of their responsibilities and are required to comply with this policy.

c. Significant privacy risks or privacy breaches will be reported to the Board of Directors as appropriate.

2. Identifying Purposes for Collection

a. CityKidz collects personal information only for purposes that are reasonable, necessary, and aligned with our mission and operations. These purposes include:
         i. Delivering safe, effective, and responsive programs for children and youth
        ii. Supporting families and caregivers, including safety and emergency-related needs
       iii. Communicating with donors, supporters, and volunteers
       iv. Issuing tax receipts and maintaining accurate fundraising records
        v. Recruiting, screening, and supporting staff and volunteers
       vi. Meeting legal, regulatory, insurance, and reporting requirements
      vii. Managing relationships with partners, vendors, and service providers
     viii. The purposes for collection are identified at or before the time personal information is collected, or as soon as reasonably        possible.

3. Consent

a. CityKidz obtains consent for the collection, use, and disclosure of personal information, except where otherwise permitted or required by law.
b. Consent may be express or implied, depending on the sensitivity of the information and the context in which it is collected. Individuals are provided with clear, plain-language information about how their personal information will be used.
c. Individuals may withdraw their consent at any time, subject to legal or contractual restrictions, by contacting CityKidz. Withdrawal of consent may limit CityKidz’ ability to provide certain services or communications.

4. Children and Youth Information

a. CityKidz recognizes that personal information relating to children and youth is particularly sensitive and requires a heightened standard of care.
b. Where appropriate, consent is obtained from a parent or legal guardian. Information is collected only to the extent necessary to support a child’s participation, safety, and well-being in CityKidz programs.

5. Limiting Collection

a. CityKidz limits the collection of personal information to what is necessary for the identified purposes. Personal information is not collected indiscriminately or for purposes unrelated to CityKidz’ mission and operations.

6. Limiting Use, Disclosure, and Retention

a. Personal information is used and disclosed only for the purposes for which it was collected, unless additional consent is obtained or disclosure is required by law.
b. CityKidz retains personal information only for as long as necessary to fulfill identified purposes, meet legal and regulatory requirements, or support operational needs. Information that is no longer required is securely destroyed, deleted, or anonymized.
c. CityKidz does not sell or trade personal information.

7.Use of Third-Party Service Providers

a. CityKidz may use third-party service providers to support its operations, including information technology, fundraising systems, payroll, communications, and data storage.
b. When personal information is shared with service providers, CityKidz requires contractual assurances that the information will be protected using appropriate safeguards and used only for authorized purposes. Some service providers may store or process information outside of Canada, in which case personal information may be subject to the laws of those jurisdictions.

8. Accuracy

a. CityKidz makes reasonable efforts to ensure that personal information is accurate, complete, and up to date for the purposes for which it is used.
b. Individuals may request access to their personal information and request corrections where information is inaccurate, incomplete, or outdated. CityKidz will update records as appropriate.

9. Safeguards

a. CityKidz uses administrative, technical, and physical safeguards appropriate to the sensitivity of the information to protect against loss, theft, unauthorized access, disclosure, copying, use, or modification.
b. Safeguards include access controls, secure systems, confidentiality obligations, and training for staff and volunteers.
c. Audits are conducted annually to ensure compliance with this policy and the effective use of established safeguards.

10. Training and Awareness

a. CityKidz recognizes that protecting personal information is a shared responsibility. CityKidz provides privacy awareness and data protection training to staff and volunteers as part of onboarding and refreshes this training periodically.
b. Training is designed to ensure that individuals understand their responsibilities under this policy, the importance of safeguarding personal information, and the appropriate handling of personal information in the course of their roles.

11. Privacy Breach Response

a. CityKidz takes privacy breaches seriously. A privacy breach includes the loss of unauthorized access to, or unauthorized disclosure of personal information.
b. All suspected or actual privacy breaches must be reported immediately to the Privacy Officer and managed in accordance with the Emergency Response Plan.
c. In the event of a breach that poses a real risk of significant harm, CityKidz will:
       i. Take immediate steps to contain and mitigate the breach.
      ii. Notify affected individuals as required.
     iii. Report the breach to the Office of the Privacy Commissioner of Canada, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA).
    iv. Maintain records of all privacy breaches in accordance with legal requirements.

12. Openness and Individual Access

a. This Privacy Policy is publicly available on the CityKidz website and may be provided upon request.
b. Individuals may request access to their personal information by submitting a written request. CityKidz will respond within a reasonable timeframe, and in accordance with applicable legislative requirements.

13. Challenging Compliance

a. Individuals may raise questions, concerns, or complaints regarding privacy practices or compliance with this policy by contacting the Privacy Officer.
b. CityKidz will investigate all concerns in a fair and timely manner and will take appropriate corrective action where warranted.
c. CityKidz will handle all concerns with discretion and respect for confidentiality, to the extent reasonably possible.

Definitions:

Business Contact Information: Information used to communicate with an individual in their professional, employment, or organizational role, such as a work email address, job title, work phone number, or employer name. Business contact information does not include personal contact details or information used for personal, fundraising, or non-business purposes.

Consent: Permission provided by an individual for the collection, use, or disclosure of their personal information.

Personal Information: Information about an identifiable individual, excluding business contact information used solely for business communications.

Privacy Breach: The loss of, unauthorized access to, or unauthorized disclosure of personal information.
Privacy Officer: The individual responsible for overseeing CityKidz’ privacy compliance, designated as the Executive Director.

Document Management and Control Owner: Board of Directors Content Manager: Executive Director Reviewed by: Executive Committee Recommended for Approval by Committee: March 17, 2026 Approved by: Board of Directors Date approved: March 24, 2026 Review date: March 2029